Decidability January 16, 2014 Slide 1 ECS 235B, Foundations of - PowerPoint PPT Presentation

Outline Security Protection Systems Decidability January 16, 2014 Slide 1 ECS 235B, Foundations of Information and Computer Security January 16, 2014

Outline Security Protection Systems 1 Security Mono-operational command case General case 2 Protection Systems Take-Grant Systems SPM Slide 2 ECS 235B, Foundations of Information and Computer Security January 16, 2014

Outline Security Protection Systems What is “Secure”? Leaking Adding a generic right r where there was not one is leaking Safe If a system S , beginning in initial state s 0 , cannot leak right r , it is safe with respect to the right r . Here, “safe” = “secure” for an abstract model Slide 3 ECS 235B, Foundations of Information and Computer Security January 16, 2014

Outline Security Protection Systems What is Does “Decidable” Mean? Safety Question Does there exist an algorithm for determining whether a protection system S with initial state s 0 is safe with respect to a generic right r ? Slide 4 ECS 235B, Foundations of Information and Computer Security January 16, 2014

Outline Security Protection Systems Mono-operational command case Mono-Operational Commands Answer: Yes! Proof sketch: Consider minimal sequence of commands c 1 , . . . , c k to leak the right Can omit delete , destroy Can merge all create s into one Worst case: insert every right into every entry; with s subjects, o objects, and n rights initially, upper bound is k ≤ n ( s + 1)( o + 1) Slide 5 ECS 235B, Foundations of Information and Computer Security January 16, 2014

Outline Security Protection Systems Mono-operational command case Proof (1) Consider minimal sequences of commands (of length m ) needed to leak r from system with initial state s 0 Identify each command by the type of primitive operation it invokes Cannot test for absence of rights, so delete , destroy not relevant Ignore them Reorder sequences of commands so all create s come first Can be done because enter s require subject, object to exist Commands after these create s check only for existence of right Slide 6 ECS 235B, Foundations of Information and Computer Security January 16, 2014

Outline Security Protection Systems Mono-operational command case Proof (2) It can be shown (see exercise): Suppose s 1 , s 2 are created, and commands test rights in A [ s 1 , o 1 ], A [ s 2 , o 2 ] Doing the same tests on A [ s 1 , o 1 ] and A [ s 1 , o 2 ] = A [ s 1 , o 2 ] ∪ A [ s 2 , o 2 ] gives same result Thus all create s unnecessary Unless s 0 is empty; then you need to create it (1 create ) In s 0 : | S 0 | number of subjects, | O 0 | number of objects, n number of (generic) rights In worst case, 1 create So a total of at most ( | S 0 | + 1)( | O 0 | + 1) elements So m ≤ n ( | S 0 | + 1)( | O 0 | + 1) Slide 7 ECS 235B, Foundations of Information and Computer Security January 16, 2014

Outline Security Protection Systems General case General Case Answer: No Proof sketch: 1 Show arbitrary Turing machine can be reduced to safety problem 2 Then deciding safety problem means deciding the halting problem Slide 8 ECS 235B, Foundations of Information and Computer Security January 16, 2014

Outline Security Protection Systems General case Turing Machine Review Infinite tape in one direction States K , symbols M , distinguished blank b / State transition function δ ( k , m ) = ( k ′ , m ′ , L) in state k with symbol m under the TM head replace m with m ′ , move head left one square, enter state k ′ Halting state is q f Slide 9 ECS 235B, Foundations of Information and Computer Security January 16, 2014

Outline Security Protection Systems General case Mapping Turing machine access control matrix representation · · · s 1 s 2 s 3 s 4 s 1 A o · · · 1 2 3 4 · · · B · · · s 2 o A B C D · · · ⇒ s 3 C k o · · · ↑ D e · · · s 4 k . . . . . ... . . . . . . . . . . Turing machine with head over square 3 on tape, in state k and its representation as an access control matrix o is own right e is end right Slide 10 ECS 235B, Foundations of Information and Computer Security January 16, 2014

Outline Security Protection Systems General case Mapping Turing machine access control matrix representation s 1 s 2 s 3 s 4 · · · A · · · s 1 o 1 2 3 4 · · · s 2 B o · · · A B X D · · · ⇒ X · · · s 3 o ↑ s 4 D k 1 e · · · k 1 . . . . . ... . . . . . . . . . . After δ ( k , C) = ( k 1 , X, R), where k is the previous state and k 1 the current state Slide 11 ECS 235B, Foundations of Information and Computer Security January 16, 2014

Outline Security Protection Systems General case Command Mapping δ ( k , C) = ( k 1 , X, R) at intermediate becomes: command c k , C ( s i , s i +1 ) i f o in A[ s i , s i +1 ] and k in A[ s i , s i ] and C in A[ s i , s i ] then delete k from A[ s i , s i ] ; delete C from A[ s i , s i ] ; enter X into A[ s i , s i ] ; enter k 1 into A[ s i +1 , s i +1 ] ; end Slide 12 ECS 235B, Foundations of Information and Computer Security January 16, 2014

Outline Security Protection Systems General case Mapping Turing machine access control matrix representation s 1 s 2 s 3 s 4 s 5 A s 1 o 1 2 3 4 5 A B X Y / b s 2 B o ⇒ ↑ s 3 X o s 4 Y o k 2 s 5 k 2 e After δ ( k 1 , D) = ( k 2 , Y, R), where k 1 is the previous state and k 2 the current state Slide 13 ECS 235B, Foundations of Information and Computer Security January 16, 2014

Outline Security Protection Systems General case Command Mapping δ ( k 1 , D) = ( k 2 , Y, R) at intermediate becomes: command crightmost k , D ( s i , s i +1 ) i f e in A[ s i , s i ] and k 1 in A[ s i , s i ] and D in A[ s i , s i ] then delete e from A[ s i , s i ] ; create subject s i +1 ; enter o into A[ s i , s i +1 ] ; enter e into A[ s i +1 , s i +1 ] ; delete k 1 from A[ s i , s i ] ; delete D from A[ s i , s i ] ; enter Y into A[ s i , s i ] ; enter k 2 into A[ s i +1 , s i +1 ] ; end Slide 14 ECS 235B, Foundations of Information and Computer Security January 16, 2014

Outline Security Protection Systems General case Rest of Proof Protection system exactly simulates a Turing machine Exactly 1 end ( e ) right in access control matrix 1 right in entries corresponds to state Thus, at most 1 applicable command If Turing machine enters state q f , then right has leaked If safety question decidable, then represent TM as protection system and determine if q f leaks This implies halting problem is decidable Conclusion: safety question undecidable Slide 15 ECS 235B, Foundations of Information and Computer Security January 16, 2014

Outline Security Protection Systems General case Other Results Set of unsafe systems is recursively enumerable Delete create primitive; then safety question is complete in P-SPACE Delete destroy , delete primitives; safety question is still undecidable Such systems are called monotonic Safety question for monoconditional, monotonic protection systems is decidable Safety question for monoconditional protection systems with create , enter , delete (and no destroy ) is decidable Slide 16 ECS 235B, Foundations of Information and Computer Security January 16, 2014

Outline Security Protection Systems Take-Grant Systems Take-Grant Protection Model A specific (not generic) system Set of rules for state transitions Safety decidable, and in time linear with the size of the system Goal: find conditions under which rights can be transferred from one entity to another in the system Slide 17 ECS 235B, Foundations of Information and Computer Security January 16, 2014

Outline Security Protection Systems Take-Grant Systems System ◦ objects (passive entities like files, . . . ) • subjects (active entities like users, processes . . . ) ⊗ don’t care (either a subject or an object) G ⊢ x G ′ apply rewriting rule x (witness) to G to get G ′ G ⊢ ∗ G ′ apply a sequence of rewriting rules (witness) to G to get G ′ R = { t , g , . . . } set of rights Slide 18 ECS 235B, Foundations of Information and Computer Security January 16, 2014

Outline Security Protection Systems Take-Grant Systems Take, Grant Rules In these rules, β ⊆ α ⊆ R β α α t t ⊗ ⊗ ⊗ ⊗ take rule • ⊢ • y y x z x z β α α g g grant rule ⊗ ⊗ ⊗ ⊗ • ⊢ • y y x z x z Slide 19 ECS 235B, Foundations of Information and Computer Security January 16, 2014

Outline Security Protection Systems Take-Grant Systems Create, Remove Rules t ⊗ create rule • ⊢ • y x x α α − β ⊗ ⊗ remove rule • ⊢ • y y x x These four rules are the de jure rules Slide 20 ECS 235B, Foundations of Information and Computer Security January 16, 2014

Outline Security Protection Systems Take-Grant Systems Symmetry of Take and Grant β g α g α ⊗ ⊗ • • ⊢ • • y y x z x z β α g α t ⊗ ⊗ • • ⊢ • • y y x z x z Slide 21 ECS 235B, Foundations of Information and Computer Security January 16, 2014

Outline Security Protection Systems Take-Grant Systems Symmetry of Take and Grant g α 1 x creates ( tg to new) v x • ⊗ • y z tg v Slide 22 ECS 235B, Foundations of Information and Computer Security January 16, 2014